# PhishDestroy domain threat record: chirsfei.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/chirsfei.com/ Machine-readable companion: https://phishdestroy.io/domain/chirsfei.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-24 08:04:32 UTC - Last availability or vendor check: 2026-10-24 10:00:22 UTC - Stored record updated: 2026-10-24 19:22:54 UTC - VirusTotal detections in the stored snapshot: 13/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 38.38.171.56 - Registrar in stored WHOIS data: Gname.com Pte. Ltd. - Last stored HTTP status: 200 - Registration date (registry RDAP, chirsfei.com): 2025-09-05 15:17:09 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1046d-972c-7692-b225-831cf55d5812/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/chirsfei.com - Certificate Transparency search: https://crt.sh/?q=%25.chirsfei.com - Web Archive lookup: https://web.archive.org/web/*/https://chirsfei.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed chirsfei.com on 2026-10-24 as a suspicious domain. A page fetched on that date returned HTTP 200 and the recorded title was “琪琪影院在线观看免费观看电视剧百度 - 高清剧集_多端同步追剧”, which described a free‑streaming TV service. The domain was first seen by PhishDestroy on the same day. How the scam works The detections suggest the site could be used for phishing or credential harvesting, a common tactic where attractive entertainment offers lure users to submit personal information. No specific malicious payload or credential‑capture form was observed on the captured page, so the exact mechanism remains uncertain. Evidence VirusTotal scanned the domain on 2026-10-04 (retrieved 2026-10-24) and returned 13 detections across 92 engines, with 12 classified as malicious and one as suspicious. Google Safe Browsing checked on 2026-10-24 and did not flag the site. urlscan.io captured the page on 2026-10-04 and gave an overall clean verdict, though its engine scoring marked it malicious with a high confidence score. Cloudflare Radar (2026-10-24) labeled the domain malicious and categorized it as phishing. OTX listed three pulses referencing the domain. PhishDestroy’s internal blocklist includes the domain, while external blocklists showed no entries. Infrastructure The domain was registered on 2025-09-05 through Gname.com Pte. Ltd., with nameservers a12.share-dns.com and b12.share-dns.net. The recorded hosting IP was 38.38.171.56, belonging to PEG TECH INC in the United States. The site used a Let’s Encrypt TLS certificate issued on 2026-10-03, valid until 2027-01-01, covering chirsfei.com and its www and m subdomains. What to do Visitors should avoid entering any credentials, personal data, or payment information on the site and change any passwords if they may have been submitted. Organizations can block DNS resolution for chirsfei.com and monitor network logs for connections to 38.38.171.56. Incident responders may enrich threat‑intel feeds with the recorded certificate and IP details and add the domain to internal blocklists. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1046d-972c-7692-b225-831cf55d5812/ Cloudflare Radar report: https://radar.cloudflare.com/scan/6950ebde-19d8-4382-8669-f34d6ebd6ba5 Stored capture screenshot: https://urlscan.io/screenshots/01a1046d-972c-7692-b225-831cf55d5812.png Cloudflare Radar screenshot (2026-10-24T08:06:01Z): https://screenshots.phishdestroy.io/cf/6950ebde-19d8-4382-8669-f34d6ebd6ba5.png VirusTotal report: https://www.virustotal.com/gui/domain/chirsfei.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=chirsfei.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-24 08:37:09 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a1046d-972c-7692-b225-831cf55d5812.png Captured: 2026-10-24 08:04:32 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a1046d-972c-7692-b225-831cf55d5812.png Captured: 2026-10-24 19:22:54 UTC Source report: https://urlscan.io/result/01a1046d-972c-7692-b225-831cf55d5812/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6950ebde-19d8-4382-8669-f34d6ebd6ba5.png Captured: 2026-10-24 08:06:01 UTC Source report: https://radar.cloudflare.com/scan/6950ebde-19d8-4382-8669-f34d6ebd6ba5 SHA-256: a448bc8288a7480ca79bfe1f708ea84c2750b044c452cbf28fbd83ad57ec1207 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-24T08:07:47Z", "uuid": "01a1046d-972c-7692-b225-831cf55d5812", "scanned_at": "2026-10-04T01:01:21Z", "final_url": "https://chirsfei.com/", "status": 200, "ip": "146.148.162.74", "domains": [ "fastly.picsum.photos", "picsum.photos", "cdnjs.cloudflare.com", "hm.baidu.com", "collect-v6.51.la", "sp0.baidu.com", "pp68.tcnui3wgap.cc", "sdk.51.la", "zz.bdstatic.com", "hz0003.com" ], "ips": [ "43.146.100.79", "103.235.46.96", "154.38.243.36", "151.101.1.91", "104.26.5.30", "218.60.100.155", "14.215.183.79", "36.248.16.48", "103.139.1.90", "104.17.24.14", "146.148.162.74" ], "asns": [ "139341", "55967", "18186", "54113", "13335", "4837", "4134", "139021", "36352" ], "countries": [ "SG", "HK", "US", "CN" ], "doc_hash": "ce9d82f00f2a01d871c9f13cd908a37dead70ef74241ce840babadd26c7f0227", "globals": [ "_hmt", "LA", "_bdhm_loaded_a879dfda41f649727d92c5f17a3076d2", "mini_tangram_log_tt8xdw", "laWaitTime" ], "cookies": [ "HMACCOUNT_BFESS", "Hm_lvt_a879dfda41f649727d92c5f17a3076d2", "Hm_lpvt_a879dfda41f649727d92c5f17a3076d2", "HMACCOUNT", "__vtins__3RGs9lwndzSAFDls", "__51uvsct__3RGs9lwndzSAFDls", "__51vcke__3RGs9lwndzSAFDls", "__51vuft__3RGs9lwndzSAFDls" ], "storage_keys": [ "Hm_lpvt_a879dfda41f649727d92c5f17a3076d2", "HMACCOUNT", "Hm_unsent_a879dfda41f649727d92c5f17a3076d2", "Hm_lvt_a879dfda41f649727d92c5f17a3076d2" ], "tls": { "san": [ "chirsfei.com", "m.chirsfei.com", "www.chirsfei.com" ], "cipher": "AES_256_GCM", "issuer": "YE2", "subject": "chirsfei.com", "protocol": "TLS 1.3", "valid_to": "2027-01-01T13:48:38Z", "valid_from": "2026-10-03T13:48:39Z" }, "domain_age_days": 1327, "apex_age_days": 1327, "tls_age_days": 0, "tls_valid_days": 89, "requests": 19, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 96, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=31536000" } }, "cf": { "v": 1, "fetched_at": "2026-10-24T08:07:49Z", "uuid": "6950ebde-19d8-4382-8669-f34d6ebd6ba5", "scanned_at": "2026-10-24T08:06:01Z", "final_url": "https://chirsfei.com/", "status": 200, "history": [ { "url": "https://chirsfei.com/", "status": 200 } ], "dom_hash": "8771924cc21809bc50373cabef0d436a3057c0e31a3000954f9f02e7537f19c3", "doc_hash": "ce9d82f00f2a01d871c9f13cd908a37dead70ef74241ce840babadd26c7f0227", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "chirsfei.com", "type": "A", "value": "38.38.171.56" } ], "dnssec_valid": false, "ip": "38.38.171.56", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Gname.com Pte. Ltd.", "created": "2025-09-05T15:17:09Z", "updated": "2026-09-30T00:08:45Z", "expires": "2027-09-05T15:17:09Z", "nameservers": [ "a12.share-dns.com", "b12.share-dns.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-24T08:35:46Z", "analysis_at": "2026-10-04T01:30:27Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 12, "suspicious": 1, "undetected": 33 }, "detections": { "CRDF": "malicious", "ESET": "suspicious", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "SOCRadar": "phishing", "Seclookup": "malicious", "Gridinsoft": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Google": "media_and_entertainment", "Sophos": "phishing and fraud", "Webroot": "Phishing and Other Frauds", "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "created": "2025-09-05T00:00:00Z", "updated": "2026-02-04T00:00:00Z", "first_seen": "2025-09-12T00:29:07Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "a.share-dns.com" }, { "ttl": 21600, "type": "NS", "value": "b.share-dns.net" }, { "ttl": 600, "type": "A", "value": "146.148.162.74" }, { "ttl": 600, "type": "SOA", "rname": "master.share-dns.com", "value": "a.share-dns.com" } ], "dns_at": "2026-10-04T01:30:45Z", "jarm": "40d40d40d00040d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d", "cert": { "san": [ "chirsfei.com", "m.chirsfei.com", "www.chirsfei.com" ], "issuer": "Let's Encrypt / YE2", "serial": "5925e3cec5d333b08416ab327745dfc2165", "sha256": "97ea89b9cdc07c248d5d3597fb8f0ccf427115d47ee01d073215f5a822e67781", "subject": "chirsfei.com", "valid_to": "2027-01-01T13:48:38Z", "valid_from": "2026-10-03T13:48:39Z" }, "whois": [], "rdap": { "status": [ "client transfer prohibited" ], "events": { "expiration": "2027-09-05T15:17:09Z", "registration": "2025-09-05T15:17:09Z", "last update of RDAP database": "2026-09-30T00:08:52Z" }, "registrar": "Gname.com Pte. Ltd.", "registrar_iana_id": "1923" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-24T08:08:11Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "chirsfei.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-02-17T11:03:41Z", "first": "2018-08-06T10:00:01Z", "changes": 7, "days_archived": 8, "scans_per_day": 0, "avg_page_bytes": 4836 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://chirsfei.com/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 1 }, "social_tags": { "title": "琪琪影院在线观看免费观看电视剧百度 - 高清剧集_多端同步追剧", "robots": "index,follow", "keywords": "琪琪影院在线观看免费观看电视剧,琪琪影院,免费在线观看电视剧,高清电视剧免费看,热门剧集在线播放,追剧网站,免费影视大全,电视剧在线观看", "description": "琪琪影院在线观看免费观看电视剧，聚合海内外热门剧集与经典老片，题材分类清晰，更新节奏稳定。支持电脑、平板、手机多端同步续看，高清画质流畅播放，追剧不用来回切换平台。想省心看剧，就来琪琪影院在线观看免费观看电视剧。" }, "trackers": { "requests": 19, "trackers": [ { "name": "Baidu Ads", "company": "Baidu", "country": "CN", "category": "Advertising", "requests": 1 }, { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 5 } ] }, "mixed_content": { "no_sri": [ "https://hz0003.com/a8.js" ], "third_party_scripts": 1 }, "status": { "up": true, "code": 200, "timings": { "dns": 124, "tls": 195, "wait": 384, "connect": 154, "download": 113 }, "response_ms": 970 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 76578, "co2_grams": 0.0028, "cleaner_than": 28 }, "dns_server": { "ns": [ { "ip": "172.64.53.25", "host": "a.share-dns.com" }, { "ip": "162.159.27.88", "host": "b.share-dns.net" } ], "zone": "chirsfei.com" }, "location": { "ip": "38.38.171.56", "asn": "54600", "org": "PEG TECH INC", "city": "San Jose", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "chirsfei.com" }, "dns": { "A": [ "38.38.171.56" ], "NS": [ "b.share-dns.net", "a.share-dns.com" ], "SOA": "{\"nsname\": \"a.share-dns.com\", \"hostmaster\": \"master.share-dns.com\", \"serial\": 1792497688, \"refresh\": 3600, \"retry\": 1200, \"expire\": 86400, \"minttl\": 600}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31536000", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "38.38.171.56", "family": 4 }, "redirects": { "chain": [ "https://chirsfei.com" ] }, "linked_pages": { "internal_count": 6 }, "whois": { "registrar": "Gname.com Pte. Ltd.", "created": "2025-09-05T15:17:09Z", "updated": "2026-09-30T00:08:45Z", "expires": "2027-09-05T15:17:09Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "a12.share-dns.com", "b12.share-dns.net" ] }, "headers": { "headers": { "server": "nginx", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=31536000" } } } } ```